This commit introduces a new connectivity test for Wireguard pod-to-pod
traffic.
The test is ran on post v1.18 clusters only.

These connectivity tests act as leak detection tests.
encrypted overlay traffic performs encryption just before the packet is going to
leave the host.
Therefore these tests ensure we do not see client->server traffic (or
its return traffic), unencrypted at the ultimate egress device before the
traffic leaves the host toward the destination.

The test works as follows:
- Find a client pod and a server pod, each on separate nodes.
- Find the client side's egress device toward the server.
- Find the server side's egress device toward the client (return
  traffic).
- Create the appropriate TCPDump filter for client->server traffic
- Create the appropriate TCPDump filter for server->client return
  traffic
- Start TCPDump sniffers on both nodes using the resolved TCPDump
  filters and egress devices.
- Ensure that we never see plain-text client->server traffic on the
  client side and we never see plain-text server->client return traffic
  on the server side.

To expand on the above
- Resolving the correct TCPDump filters involves understanding what
  routing mode we are. When tunnel mode is use the test will create
  TCPDump filters which seek into the tunnel packets to find plain-text
  inner IP headers.
- We filter for client->server traffic on the client node is encrypted and
  server->client return traffic on the server node is as well. We do not
  check if server->client return traffic on the CLIENT node is
  encrypted. This is because XFRM will recirculate decrypted packets on
  the interface they arrived on. If we filter for the return traffic
  we'd get false positives since TCPDump will confuse the decrypted
  traffic for a leak. This is why we test the return traffic is
  encrypted, server side. While the initial introduction to these tests
  target wireguard, we keep this invariant to easily support IPsec as
  well.
- These tests also run when encryption is disabled on the cluster,
  switching the TCPDump instance to report an error if NO packets are
  detected. This is a sanity check ensuring the TCPDump filters would
  in-fact catch leaked traffic when encryption is enabled.

There is more subtlety to this test that are drawn attention to by the
comments and it is useful to read through these.

This test will also be used for IPsec pod-to-pod traffic once VinE is
properly implemented, unifying the testing approach for both Wireguard
and IPsec.

Signed-off-by: Louis DeLosSantos <louis.delos@isovalent.com>